Detect Excessive Account Lockouts From Endpoint

Description

This search identifies endpoints that have caused a relatively high number of account lockouts in a short period.

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Security Monitoring

Category

Account Compromise

Alert Volume

This search identifies endpoints that have caused a relatively high number of account lockouts in a short period.

SPL Difficulty

None

Journey

Stage 1

MITRE ATT&CK Tactics

Defense Evasion
Persistence
Privilege Escalation
Initial Access

MITRE ATT&CK Techniques

Valid Accounts

Domain Accounts

MITRE Threat Groups

APT29
APT3
TA505
Threat Group-1314
Wizard Spider

Data Sources

Authentication

   Help

Detect Excessive Account Lockouts From Endpoint Help

You must ingest your Windows security event logs in the Change datamodel under the nodename is Account_Management, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. \ Splunk>Phantom Playbook Integration\ If Splunk>Phantom is also configured in your environment, a Playbook called "Excessive Account Lockouts Enrichment and Response" can be configured to run when any results are found by this detection search. The Playbook executes the Contextual and Investigative searches in this Story, conducts additional information gathering on Windows endpoints, and takes a response action to shut down the affected endpoint. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. \ (Playbook Link:https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/).\

   Search

Open in Search